General

  • Target

    arm7.elf

  • Size

    168KB

  • Sample

    250106-3fe2yavmdj

  • MD5

    b650efbe5d301336e171f76ac6854af1

  • SHA1

    8453546c4a920f65315a046b6579c89cdffbf8e5

  • SHA256

    f926f3e5ca5b14237b37cbfd2a2d8653ed67a965f39566d5b12974b272b6c4b5

  • SHA512

    feab3f5f386d678ce1cc8ab2fce9234b048e6b2c0367397826b6c5359accf52945f8c9b2164763887d42f3b819019da8e9b5a39321c4d7790a26f0677912f2d4

  • SSDEEP

    3072:8qwG+C1QT6mXRfDUnhaRkZzOQEfcl/lawSosRMD27WOagM/9regU9:8qwG1mBf4haRkZzOQE0l/Qw0q27WOhMA

Malware Config

Extracted

Family

mirai

Botnet

MIRAI

Targets

    • Target

      arm7.elf

    • Size

      168KB

    • MD5

      b650efbe5d301336e171f76ac6854af1

    • SHA1

      8453546c4a920f65315a046b6579c89cdffbf8e5

    • SHA256

      f926f3e5ca5b14237b37cbfd2a2d8653ed67a965f39566d5b12974b272b6c4b5

    • SHA512

      feab3f5f386d678ce1cc8ab2fce9234b048e6b2c0367397826b6c5359accf52945f8c9b2164763887d42f3b819019da8e9b5a39321c4d7790a26f0677912f2d4

    • SSDEEP

      3072:8qwG+C1QT6mXRfDUnhaRkZzOQEfcl/lawSosRMD27WOagM/9regU9:8qwG1mBf4haRkZzOQE0l/Qw0q27WOhMA

    • Deletes itself

    • Modifies Watchdog functionality

      Malware like Mirai modifies the Watchdog to prevent it restarting an infected system.

    • Modifies systemd

      Adds/ modifies systemd service files. Likely to achieve persistence.

MITRE ATT&CK Enterprise v15

Tasks